feat(ci): prune release assets outside the newest two tags (#52)

Gitea has no release-asset retention, so every v* tag kept its full
cross-platform binary set forever — 31 tags had accumulated 1.8 GB on the
production host disk. Nothing consumes an old asset: CI takes the Crucible
binary from the Nix flake, and every deleted file is reproducible from its tag.

scripts/prune-release-assets.sh lists every release page, sorts by creation
date, skips the newest two published releases, and deletes the remaining
releases' attachments. Two rather than one so a release in flight never leaves
the previous download broken. Drafts never consume a keep slot. Releases, tags,
source archives and release notes are untouched.

Nothing is excluded — SHA256SUMS and the wrappers go with the binaries: the
checksums are only meaningful next to the files they cover, and the consumer
drift-check reads the wrappers from the latest release, which stays complete.

The step is best-effort: a stale asset is cheaper than a blocked publish, so
API failures warn and the step carries continue-on-error.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/workflow-contract.sh

@@ -46,6 +46,8 @@ grep -Fqx '  releases: write' "$release"
 grep -Fqx '    timeout-minutes: 30' "$release"
 [[ "$(grep -Fc "$checkout" "$release")" -eq 1 ]]
 grep -Fq 'secrets.GITEA_TOKEN' "$release"
+grep -Fq 'scripts/prune-release-assets.sh' "$release"
+grep -Fq 'continue-on-error: true' "$release"
 if grep -Fq 'secrets.GITHUB_TOKEN' "$release"; then
   echo "workflow-contract: release uses the GitHub token alias" >&2
   exit 1